From 8ddffc298baf69e7c4d99304ae5142c3d3c75b68 Mon Sep 17 00:00:00 2001
From: dstepanic17 <57736958+dstepanic17@users.noreply.github.com>
Date: Tue, 24 Aug 2021 13:17:28 -0700
Subject: [PATCH] [New rule] Webshell Detection (#1448)

* [new-rule] Webshell Detection

* Update rules/windows/persistence_webshell_detection.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Added FP note section

* Update rules/windows/persistence_webshell_detection.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
---
 .../persistence_webshell_detection.toml       | 66 +++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 rules/windows/persistence_webshell_detection.toml

diff --git a/rules/windows/persistence_webshell_detection.toml b/rules/windows/persistence_webshell_detection.toml
new file mode 100644
index 000000000..51a534664
--- /dev/null
+++ b/rules/windows/persistence_webshell_detection.toml
@@ -0,0 +1,66 @@
+[metadata]
+creation_date = "2021/08/24"
+maturity = "production"
+updated_date = "2021/08/24"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
+"""
+false_positives = [
+    """
+    Security audits, maintenance and network administrative scripts may trigger this alert when run under web processes.
+    """,
+]
+from = "now-9m"
+index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
+language = "eql"
+license = "Elastic License v2"
+name = "Webshell Detection: Script Process Child of Common Web Processes"
+note = """## Triage and analysis
+
+Detections should be investigated to identify if the activity corresponds to legitimate activity. As this rule detects post-exploitation process activity, investigations into this should be prioritized."""
+references = ["https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/"]
+risk_score = 73
+rule_id = "2917d495-59bd-4250-b395-c29409b76086"
+severity = "high"
+tags = ["Elastic", "Host", "Windows", "Threat Detection", "Persistence"]
+timestamp_override = "event.ingested"
+type = "eql"
+
+query = '''
+process where event.type == "start" and
+  process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe", "tomcat.exe") and 
+  process.name : ("cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe")
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1505"
+name = "Server Software Component"
+reference = "https://attack.mitre.org/techniques/T1505/"
+[[rule.threat.technique.subtechnique]]
+id = "T1505.003"
+name = "Web Shell"
+reference = "https://attack.mitre.org/techniques/T1505/003/"
+
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+
+[rule.threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"